Linux AWK 命令用法简介

àì夳堔傛蜴生んèń 2022-06-14 07:13 231阅读 0赞

参考：  
[AWK简明教程][AWK]  
坐马桶拉大便的时读完却花了一上午。。。于是便秘了

## 准备工作 ##

将`netstat`的输出重定向到文本文件

netstat -antl > netstat.txt

## awk示例 ##

### 1.使用awk提取`netstat`中的信息 ###

awk '{print $1,$4}' netstat.txt
    
    #将显示第1行和第4行的内容
    tcp 127.0.0.1:5939
    tcp 127.0.1.1:53
    tcp 0.0.0.0:22
    tcp 127.0.0.1:631
    tcp 127.0.0.1:5432
    tcp 0.0.0.0:8090
    tcp 0.0.0.0:7
    tcp 127.0.0.1:44329
    tcp 127.0.0.1:3306
    tcp 127.0.0.1:6379
    tcp 0.0.0.0:13
    tcp6 :::8080
    tcp6 :::22
    tcp6 ::1:631
    tcp6 :::8088
    tcp6 ::1:5432
    tcp6 127.0.0.1:8005
    tcp6 ::1:53615

### 2.使用awk进行格式化输出 ###

awk '{printf "%-8s %-8s %-8s %-18s %-22s %-15s\n",$1,$2,$3,$4,$5,$6}' netstat.txt
    
    
    tcp      0        0        127.0.0.1:5939     0.0.0.0:*              LISTEN         
    tcp      0        0        127.0.1.1:53       0.0.0.0:*              LISTEN         
    tcp      0        0        0.0.0.0:22         0.0.0.0:*              LISTEN         
    tcp      0        0        127.0.0.1:631      0.0.0.0:*              LISTEN         
    tcp      0        0        127.0.0.1:5432     0.0.0.0:*              LISTEN         
    tcp      0        0        0.0.0.0:8090       0.0.0.0:*              LISTEN         
    tcp      0        0        0.0.0.0:7          0.0.0.0:*              LISTEN         
    tcp      0        0        127.0.0.1:44329    0.0.0.0:*              LISTEN         
    tcp      0        0        127.0.0.1:3306     0.0.0.0:*              LISTEN         
    tcp      0        0        127.0.0.1:6379     0.0.0.0:*              LISTEN         
    tcp      0        0        0.0.0.0:13         0.0.0.0:*              LISTEN         
    tcp      0        1        10.170.18.11:42514 117.34.37.32:443       LAST_ACK       
    tcp      0        0        10.170.18.11:49747 192.30.253.125:443     ESTABLISHED    
    tcp      1        0        127.0.0.1:51968    127.0.0.1:44329        CLOSE_WAIT     
    tcp      0        1        10.170.18.11:42512 117.34.37.32:443       LAST_ACK       
    tcp      0        1        10.170.18.11:35324 117.34.37.33:443       LAST_ACK       
    tcp6     0        0        :::8080            :::*                   LISTEN         
    tcp6     0        0        :::22              :::*                   LISTEN         
    tcp6     0        0        ::1:631            :::*                   LISTEN         
    tcp6     0        0        :::8088            :::*                   LISTEN         
    tcp6     0        0        ::1:5432           :::*                   LISTEN         
    tcp6     0        0        127.0.0.1:8005     :::*                   LISTEN         
    tcp6     1        0        ::1:53615          ::1:631                CLOSE_WAIT

### 3.使用awk过滤记录 ###

比如说，只显示ESTABLISHED的连接

netstat -atnl | awk '$6=="ESTABLISHED" {printf "%8s %8s %8s %18s %20s %20s\n",$1,$2,$3,$4,$5,$6}'
    tcp        0        0     127.0.0.1:5939            0.0.0.0:*          ESTABLISHED
    tcp        0        0       127.0.1.1:53            0.0.0.0:*          ESTABLISHED
    tcp        0        0         0.0.0.0:22            0.0.0.0:*          ESTABLISHED
    tcp        0        0      127.0.0.1:631            0.0.0.0:*          ESTABLISHED
    tcp        0        0     127.0.0.1:5432            0.0.0.0:*          ESTABLISHED
    tcp        0        0       0.0.0.0:8090            0.0.0.0:*          ESTABLISHED
    tcp        0        0    127.0.0.1:40770            0.0.0.0:*          ESTABLISHED
    tcp        0        0          0.0.0.0:7            0.0.0.0:*          ESTABLISHED
    tcp        0        0     127.0.0.1:3306            0.0.0.0:*          ESTABLISHED
    tcp        0        0     127.0.0.1:6379            0.0.0.0:*          ESTABLISHED
    tcp        0        0         0.0.0.0:13            0.0.0.0:*          ESTABLISHED
    tcp6        0        0            :::8080                 :::*          ESTABLISHED
    tcp6        0        0              :::22                 :::*          ESTABLISHED
    tcp6        0        0            ::1:631                 :::*          ESTABLISHED
    tcp6        0        0            :::8088                 :::*          ESTABLISHED
    tcp6        0        0           ::1:5432                 :::*          ESTABLISHED
    tcp6        0        0     127.0.0.1:8005                 :::*          ESTABLISHED

### 4.awk内建变量 ###

<table> 
 <thead> 
  <tr> 
   <th align="center">变量名</th> 
   <th align="center">说明</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td align="center">$0</td> 
   <td align="center">整行内容</td> 
  </tr> 
  <tr> 
   <td align="center"><span></span><span> <span style="width: 1.638em; display: inline-block;"><span style="display: inline-block; position: relative; width: 1.513em; height: 0px; font-size: 106%;"><span style="position: absolute; clip: rect(1.89em 1000em 2.959em -0.5em); top: -2.764em; left: 0.003em;"><span><span style="font-family: MathJax_Main;">1</span><span style="font-family: MathJax_Main; padding-left: 0.255em;">−</span></span><span style="display: inline-block; width: 0px; height: 2.77em;"></span></span></span><span style="border-left: 0.003em solid; display: inline-block; overflow: hidden; width: 0px; height: 0.87em; vertical-align: -0.063em;"></span></span> </span>n</td> 
   <td align="center">第n个字段</td> 
  </tr> 
  <tr> 
   <td align="center">FS</td> 
   <td align="center">分隔符空格或者Tab</td> 
  </tr> 
  <tr> 
   <td align="center">NR</td> 
   <td align="center">行号</td> 
  </tr> 
  <tr> 
   <td align="center">FNR</td> 
   <td align="center">文件自己的行号</td> 
  </tr> 
  <tr> 
   <td align="center">RS</td> 
   <td align="center">输入记录分隔符,默认为换行</td> 
  </tr> 
  <tr> 
   <td align="center">OFS</td> 
   <td align="center">输出字段分隔符,默认为空格</td> 
  </tr> 
  <tr> 
   <td align="center">ORS</td> 
   <td align="center">输出的记录分隔符,默认为换行</td> 
  </tr> 
  <tr> 
   <td align="center">FILENAME</td> 
   <td align="center">文件名</td> 
  </tr> 
 </tbody> 
</table>

比如输出行号：

awk '$6="ESTABLISHED" {print NR " " FNR " "  $0}' netstat.txt

比如指定分隔符：

awk 'BEGIN{FS=":"} {print $1,$3,$6}' /etc/passwd
    
    awk -F: '{print $1,$3,$6}' OFS="\t" /etc/passwd

### 5.awk字符串匹配 ###

可以利用正则表达式匹配

awk '$6 ~ /FIN|WAIT/ {print NR,$4,$5,$6}' OFS="\t" netstat.txt

也可以像`grep`一样匹配

awk '/ESTABLISHED/' netstat.txt

模式取反

awk  '$6 !~ /ESTABLISHED/' netstat.txt
    #或者
    awk '!/ESTABLISHED/ netstat.txt'

### 6.awk处理文件 ###

awk拆分文件，使用重定向就好

awk 'NR!=1&&NR!=2 {print > $6}' netstat.txt
    awk 'NR!=1&&NR!=2 {print $4,$5 > $6}' netstat.txt ## 指定列输出到文件

将按照第6列分隔文件

awk 'NR!=1&&NR!=2 {
       if($6 ~/TIME|ESTABLISHED/) print > "1.txt";else print >"2.txt"}' netstat.txt

指定输出文件

### 7.awk统计 ###

计算所有.h .c .cpp文件大小总和，`ls -l`命令的文件大小将出现在第5列

ls -l *.cpp *.c *.h | awk '{sum+=$5} END {print sum}'

统计文件中某些字符出现的次数,  
本例中将统计，各个状态的连接的个数

awk 'NR!=1&&NR!=2 {a[$6]++;} END {
        for (i in a )print i ", " a[i];}' netstat.txt

统计每个用户的进程占了多少内存

ps aux | awk 'NR!=1{a[$1]+=$6;} END {
        for(i in a) print i ", " a[i]"KB"}'

### 8.几个例子 ###

#从file中找出长度大于80的行
    awk 'length>80' file
    
    #连接数查看客户端IP
    netstat -ntu4 | awk 'NR!=1&&NR!=2 {print $5}' | cut -d: -f1 | sort | uniq -c | sort -nr

[AWK]: http://coolshell.cn/articles/9070.html